<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 4.2.0">
  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">


<link rel="stylesheet" href="/lib/font-awesome/css/all.min.css">
  <link rel="stylesheet" href="//cdn.jsdelivr.net/gh/fancyapps/fancybox@3/dist/jquery.fancybox.min.css">

<script id="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"gwashitgton.gitee.io","root":"/","scheme":"Gemini","version":"7.8.0","exturl":false,"sidebar":{"position":"left","display":"post","padding":18,"offset":12,"onmobile":false},"copycode":{"enable":true,"show_result":true,"style":"mac"},"back2top":{"enable":true,"sidebar":false,"scrollpercent":true},"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":true,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"algolia":{"hits":{"per_page":10},"labels":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}},"localsearch":{"enable":"enable","trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},"path":"search.xml"};
  </script>

  <meta name="description" content="Linux 系统安全加固">
<meta property="og:type" content="article">
<meta property="og:title" content="Linux系统安全加固">
<meta property="og:url" content="https://gwashitgton.gitee.io/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/">
<meta property="og:site_name" content="Enterprise">
<meta property="og:description" content="Linux 系统安全加固">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://upload-images.jianshu.io/upload_images/20430499-a8b095d9a64db8ff.jpg?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240">
<meta property="og:image" content="https://upload-images.jianshu.io/upload_images/20430499-64ba77898c0c4d17.jpg?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240">
<meta property="article:published_time" content="2020-04-23T05:37:47.000Z">
<meta property="article:modified_time" content="2020-04-23T05:44:37.462Z">
<meta property="article:author" content="Odin">
<meta property="article:tag" content="Linux">
<meta property="article:tag" content="安全加固">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://upload-images.jianshu.io/upload_images/20430499-a8b095d9a64db8ff.jpg?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240">

<link rel="canonical" href="https://gwashitgton.gitee.io/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>

  <title>Linux系统安全加固 | Enterprise</title>
  


  <script>
    var _hmt = _hmt || [];
    (function() {
      var hm = document.createElement("script");
      hm.src = "https://hm.baidu.com/hm.js?a3850f6ef1a87fae200c86d8a5c3a0d7";
      var s = document.getElementsByTagName("script")[0];
      s.parentNode.insertBefore(hm, s);
    })();
  </script>




  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

<link rel="alternate" href="/atom.xml" title="Enterprise" type="application/atom+xml">
</head>
<script type="text/javascript" src="/js/love.js"></script>
<body itemscope itemtype="http://schema.org/WebPage">
  <div class="container use-motion">
    <div class="headband"></div>

    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏">
      <span class="toggle-line toggle-line-first"></span>
      <span class="toggle-line toggle-line-middle"></span>
      <span class="toggle-line toggle-line-last"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <h1 class="site-title">Enterprise</h1>
      <span class="logo-line-after"><i></i></span>
    </a>
      <p class="site-subtitle" itemprop="description">纸上得来终觉浅，绝知此事要躬行</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
        <i class="fa fa-search fa-fw fa-lg"></i>
    </div>
  </div>
</div>




<nav class="site-nav">
  <ul id="menu" class="main-menu menu">
        <li class="menu-item menu-item-home">

    <a href="/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a>

  </li>
        <li class="menu-item menu-item-tags">

    <a href="/tags/" rel="section"><i class="fa fa-tags fa-fw"></i>标签</a>

  </li>
        <li class="menu-item menu-item-categories">

    <a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类</a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档</a>

  </li>
      <li class="menu-item menu-item-search">
        <a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索
        </a>
      </li>
  </ul>
</nav>



  <div class="search-pop-overlay">
    <div class="popup search-popup">
        <div class="search-header">
  <span class="search-icon">
    <i class="fa fa-search"></i>
  </span>
  <div class="search-input-container">
    <input autocomplete="off" autocapitalize="off"
           placeholder="搜索..." spellcheck="false"
           type="search" class="search-input">
  </div>
  <span class="popup-btn-close">
    <i class="fa fa-times-circle"></i>
  </span>
</div>
<div id="search-result">
  <div id="no-result">
    <i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>
  </div>
</div>

    </div>
  </div>

</div>
    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>
  <div class="reading-progress-bar"></div>

  <a href="https://github.com/Grergo" class="github-corner" title="Follow me on GitHub" aria-label="Follow me on GitHub" rel="noopener" target="_blank"><svg width="80" height="80" viewBox="0 0 250 250" aria-hidden="true"><path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path><path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2" fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path><path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z" fill="currentColor" class="octo-body"></path></svg></a>


    <main class="main">
      <div class="main-inner">
        <div class="content-wrap">
          

          <div class="content post posts-expand">
            

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="https://gwashitgton.gitee.io/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="https://gitee.com/GWashitgton/Picture/raw/master/image/20200422132544.JPG">
      <meta itemprop="name" content="Odin">
      <meta itemprop="description" content="">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Enterprise">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          Linux系统安全加固
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-calendar"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>
              

              <time title="创建时间：2020-04-23 13:37:47 / 修改时间：13:44:37" itemprop="dateCreated datePublished" datetime="2020-04-23T13:37:47+08:00">2020-04-23</time>
            </span>
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-folder"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/Linux/" itemprop="url" rel="index"><span itemprop="name">Linux</span></a>
                </span>
            </span>

          
  
  <span class="post-meta-item">
    
      <span class="post-meta-item-icon">
        <i class="far fa-comment"></i>
      </span>
      <span class="post-meta-item-text">Valine：</span>
    
    <a title="valine" href="/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/#valine-comments" itemprop="discussionUrl">
      <span class="post-comments-count valine-comment-count" data-xid="/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/" itemprop="commentCount"></span>
    </a>
  </span>
  
  <br>
            <span class="post-meta-item" title="本文字数">
              <span class="post-meta-item-icon">
                <i class="far fa-file-word"></i>
              </span>
                <span class="post-meta-item-text">本文字数：</span>
              <span>3.5k</span>
            </span>
            <span class="post-meta-item" title="阅读时长">
              <span class="post-meta-item-icon">
                <i class="far fa-clock"></i>
              </span>
                <span class="post-meta-item-text">阅读时长 &asymp;</span>
              <span>3 分钟</span>
            </span>
            <div class="post-description">Linux 系统安全加固</div>

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
        <a id="more"></a>
<!-- markdownlint-disable MD041 MD002-->

<h1 id="Linux-安全加固"><a href="#Linux-安全加固" class="headerlink" title="Linux 安全加固"></a>Linux 安全加固</h1><p><strong>这里使用Cent OS 7.5 版本</strong></p>
<p><strong>一、系统安装</strong></p>
<p>系统镜像尽量从官网下载，下载完成后要与官方给的hash值进行对比，以防安装镜像出现问题。安装时选择最小安装，避免安装不必要的软件与服务，减少出现漏洞的可能性。</p>
<p><strong>二、关闭不必要的服务</strong></p>
<p>根据不同的业务需要，需要关闭不必要的服务。这里以postfix服务为例，演示如何关闭不必要的服务。</p>
<figure class="highlight maxima"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">查看服务状态：</span><br><span class="line">systemctl <span class="built_in">status</span> <span class="built_in">postfix</span></span><br></pre></td></tr></table></figure>

<p><img src="https://upload-images.jianshu.io/upload_images/20430499-a8b095d9a64db8ff.jpg?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240" alt="查看服务状态.jpg"></p>
<p>该服务状态为active，表示这个服务处于运行状态。接下来关闭这个服务。</p>
<figure class="highlight gauss"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">systemctl <span class="keyword">stop</span> postfix <span class="meta">#这样只能保证不重启Linux时服务是关闭的，要彻底关闭需要以下命令</span></span><br><span class="line">systemctl <span class="keyword">disable</span> postfix <span class="meta">#彻底关闭postfix服务</span></span><br></pre></td></tr></table></figure>
<p><img src="https://upload-images.jianshu.io/upload_images/20430499-64ba77898c0c4d17.jpg?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240" alt="关闭系统服务.jpg"></p>
<p>如果状态是inactive dead状体，表示服务关闭。</p>
<p>下面列举一些Cent OS常用的服务以及建议：</p>
<table>
<thead>
<tr>
<th align="center"><strong>服务名</strong></th>
<th align="center"><strong>解释</strong></th>
<th align="center"><strong>建议</strong></th>
</tr>
</thead>
<tbody><tr>
<td align="center">iptables</td>
<td align="center">防火墙服务</td>
<td align="center">根据实际需要自行判断</td>
</tr>
<tr>
<td align="center">xinetd</td>
<td align="center">支持多重网络的核心进程</td>
<td align="center">建议开启</td>
</tr>
<tr>
<td align="center">network</td>
<td align="center">网络服务</td>
<td align="center">必须开启</td>
</tr>
<tr>
<td align="center">sshd</td>
<td align="center">远程登录服务</td>
<td align="center">建议开启</td>
</tr>
<tr>
<td align="center">rsyslog</td>
<td align="center">系统日志服务</td>
<td align="center">必须开启</td>
</tr>
<tr>
<td align="center">crond</td>
<td align="center">计划任务服务</td>
<td align="center">必须开启</td>
</tr>
<tr>
<td align="center">atd</td>
<td align="center">一次性计划任务服务</td>
<td align="center">如果不需要可以关闭</td>
</tr>
<tr>
<td align="center">auditd</td>
<td align="center">审计服务</td>
<td align="center">必须开启</td>
</tr>
<tr>
<td align="center">autovt</td>
<td align="center">登录相关服务</td>
<td align="center">必须开启</td>
</tr>
<tr>
<td align="center">getty</td>
<td align="center">tty控制台相关</td>
<td align="center">必须开启</td>
</tr>
<tr>
<td align="center">irqbalance</td>
<td align="center">优化系统中断分配服务</td>
<td align="center">建议开启</td>
</tr>
<tr>
<td align="center">kdump</td>
<td align="center">内核崩溃信息捕获服务</td>
<td align="center">建议开启</td>
</tr>
<tr>
<td align="center">microcode</td>
<td align="center">处理器微码服务</td>
<td align="center">建议开启</td>
</tr>
<tr>
<td align="center">postfix</td>
<td align="center">邮件服务</td>
<td align="center">如果不需要建议关闭</td>
</tr>
<tr>
<td align="center">networkManager</td>
<td align="center">图形化网卡配置</td>
<td align="center">建议关闭</td>
</tr>
</tbody></table>
<p><strong>三、账号设置</strong></p>
<figure class="highlight dts"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">账号删减命令：</span><br><span class="line">userdel <span class="params">&lt;用户名&gt;</span> <span class="meta">#删除用户</span></span><br><span class="line">passwd -l <span class="params">&lt;用户名&gt;</span> <span class="meta">#锁定用户</span></span><br><span class="line">passwd -u <span class="params">&lt;用户名&gt;</span> <span class="meta">#解锁用户</span></span><br></pre></td></tr></table></figure>

<p>查看是否有空口令和root权限的用户：</p>
<p><code>awk -F: &#39;($2==&quot;&quot;)&#39; /etc/shadow</code> 查看空口令用户</p>
<p><code>awk -F: &#39;($3==0)&#39; /etc/passwd</code> 查看UID为0的用户，也就是root权限用户</p>
<p>禁止root用户通过SSH直接登录：</p>
<p>注意：操作此步骤之前，需要创建普通权限用户，防止无法远程登录。</p>
<p>修改<code>/etc/ssh/sshd_config</code>文件，修改PermitRootLogin 的值修改为no，然后重启SSH服务。</p>
<p><strong>四、用户组设置</strong></p>
<p>禁用或删除组:</p>
<p>查看<code>/etc/group</code>中是否有不使用的组，如果有，应该禁用或者删除。</p>
<figure class="highlight routeros"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"> cat /etc<span class="built_in">/group </span>#查看文件内容</span><br><span class="line">修改之前先备份</span><br><span class="line">cp /etc<span class="built_in">/group </span>/etc/group.bak</span><br><span class="line">然后编辑/group文件，将不需要的组所在的行注释掉就可以了</span><br><span class="line">或者直接使用命令groupdel &lt;组名&gt; 删除掉这个组</span><br></pre></td></tr></table></figure>

<p>从组中删除用户：</p>
<p><code>gpasswd -d &lt;用户名&gt; &lt;组名&gt;</code></p>
<p><strong>五、SSH加固</strong></p>
<p><strong><a href="https://www.jianshu.com/p/a953e70ea997" target="_blank" rel="noopener">参照我之前这篇文章</a></strong></p>
<p><strong>六、禁用ctrl+alt+delete 组合键</strong></p>
<p>在机房控制台的键盘上，如果不小心按了ctrl+alt+del键，就会将Linux系统重启，给系统造成了一定的安全隐患。</p>
<p>禁用ctrl+alt+delete重启功能：</p>
<p><code>rm -rf /usr/lib/systemd/system/ctrl-alt-del.target</code> 删除映射的软连接即可</p>
<p><strong>七、禁用历史命令</strong></p>
<p>Linux默认会保存历史命令，这会带来一些安全隐患，使用如下配置禁用历史命令。</p>
<figure class="highlight routeros"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">修改之前，先备份</span><br><span class="line">cp /etc<span class="built_in">/profile </span>/etc/profile.bak</span><br><span class="line">编辑profile文件</span><br><span class="line">修改<span class="attribute">HISTSIZE</span>=1000 改为 <span class="attribute">HISTSIZE</span>=1 即可</span><br></pre></td></tr></table></figure>

<p><strong>八、开启系统日志</strong></p>
<p>Linux 系统应该开启系统日志，这样出现意外情况能够溯源。</p>
<figure class="highlight pgsql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">保存在本地：</span><br><span class="line">systemctl <span class="keyword">enable</span> rsyslog</span><br><span class="line">systemctl <span class="keyword">start</span> rsyslog</span><br></pre></td></tr></table></figure>

<p><strong>九、重要文件锁定</strong></p>
<p>锁定用户和组相关文件，避免恶意添加后门。</p>
<p><code>chattr +i /etc/passwd,/etc/group,/etc/shadow,/etc/gshadow</code></p>
<p>注意：这些文件锁定之后，如果需要添加或者删除用户，需要将这些文件先解锁，之后再将其锁定。</p>
<p>解锁：<code>chattr -i /etc/passwd,/etc/group,/etc/shadow,/etc/gshadow</code></p>
<p>将系统日志文件锁定：只允许追加写入内容，不允许删除，不允许清空。</p>
<p><code>chattr +a /var/log/secure</code> 其他日志文件一样的操作。</p>
<p><strong>十、安装完整新检查工具(AIDE)</strong></p>
<blockquote>
<p>介绍：AIDE是一个完整性检测工具，可以检查系统中是否有文件被修改、删除、添加等。主要用于定期检测系统是否被挂了木马。</p>
<p>除了AIDE之外，常用的完整性检测工具还有tripwire。</p>
<p>工作原理：</p>
<p>通常情况下，系统运维人员安装一个新的Linux操作系统之后，会创建相应的账号、安装需要的软件并部署相关的代码。接下来系统会处于一个相对稳定的状态。AIDE的工作原理，就是在这种状态下，将系统中指定的文件的属性记录到数据库中。经过一段时间后，再次执行AIDE时，会生成另外一个数据库。只要比对这两个数据库的文件属性，就可以发现哪些文件被篡改了。</p>
</blockquote>
<p><code>yum install aide -y</code> 安装AIDE</p>
<p>配置文件解释：</p>
<figure class="highlight vala"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br></pre></td><td class="code"><pre><span class="line">@@define DBDIR /<span class="keyword">var</span>/lib/aide # 定义AIDE数据库存放目录</span><br><span class="line">@@define LOGDIR /<span class="keyword">var</span>/log/aide # 定义AIDE日志文件存放目录</span><br><span class="line">database=file:@@&#123;DBDIR&#125;/aide.db.gz # 定义AIDE旧数据库文件名称</span><br><span class="line">database_out=file:@@&#123;DBDIR&#125;/aide.db.<span class="keyword">new</span>.gz # 定义AIDE新数据库文件名称</span><br><span class="line"><span class="meta"># 生成的这两个数据库文件进行比对，可以发现修改的文件</span></span><br><span class="line">gzip_dbout=yes # 数据库文件使用gzip压缩</span><br><span class="line">verbose=<span class="number">5</span> # 日志级别，越大越详细</span><br><span class="line">report_url=file:@@&#123;LOGDIR&#125;/aide.log # 定义AIDE日志文件名称</span><br><span class="line">report_url=<span class="keyword">stdout</span> # 对比数据库时，会输出到日志文件，还会输入到屏幕，也就是标准输出</span><br><span class="line"><span class="meta"># 以下是可以定义的监控值：</span></span><br><span class="line"><span class="meta">#p: permissions</span></span><br><span class="line"><span class="meta">#i: inode:</span></span><br><span class="line"><span class="meta">#n: number of links</span></span><br><span class="line"><span class="meta">#u: user</span></span><br><span class="line"><span class="meta">#g: group</span></span><br><span class="line"><span class="meta">#s: size</span></span><br><span class="line"><span class="meta">#b: block count</span></span><br><span class="line"><span class="meta">#m: mtime</span></span><br><span class="line"><span class="meta">#a: atime</span></span><br><span class="line"><span class="meta">#c: ctime</span></span><br><span class="line"><span class="meta">#S: check for growing size</span></span><br><span class="line"><span class="meta">#acl: Access Control Lists</span></span><br><span class="line"><span class="meta">#selinux SELinux security context</span></span><br><span class="line"><span class="meta">#xattrs: Extended file attributes</span></span><br><span class="line"><span class="meta">#md5: md5 checksum</span></span><br><span class="line"><span class="meta">#sha1: sha1 checksum</span></span><br><span class="line"><span class="meta">#sha256: sha256 checksum</span></span><br><span class="line"><span class="meta">#sha512: sha512 checksum</span></span><br><span class="line"><span class="meta">#rmd160: rmd160 checksum</span></span><br><span class="line"><span class="meta">#tiger: tiger checksum</span></span><br><span class="line"><span class="meta"># 以下是系统定义的检测的内容的集合，</span></span><br><span class="line"><span class="meta">#R: p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5</span></span><br><span class="line"><span class="meta">#L: p+i+n+u+g+acl+selinux+xattrs</span></span><br><span class="line"><span class="meta">#E: Empty group</span></span><br><span class="line"><span class="meta">#&gt;: Growing logfile p+u+g+i+n+S+acl+selinux+xattrs</span></span><br><span class="line"><span class="meta"># 可以参考这个自己定义检测的内容的集合：</span></span><br><span class="line">EVERYTHING = R+ALLXTRAHASHES</span><br><span class="line">CONTENT_EX = sha256+ftype+p+u+g+n+acl+selinux+xattrs</span><br><span class="line"><span class="meta"># 以下是要监控哪些目录的集合：</span></span><br><span class="line">/boot/ CONTENT_EX # AIDE会递归的监控目录</span><br><span class="line">/bin/ CONTENT_EX</span><br><span class="line">/sbin/ CONTENT_EX</span><br><span class="line">/lib/ CONTENT_EX</span><br><span class="line">/lib64/ CONTENT_EX</span><br><span class="line">/opt/ CONTENT</span><br><span class="line"><span class="meta"># 以下是要排除的目录：</span></span><br><span class="line">!/usr/src/</span><br><span class="line">!/usr/tmp/</span><br></pre></td></tr></table></figure>

<p><code>aide -i</code> 初始化aide</p>
<p><code>aide --check</code> 对比数据库文件</p>
<p><strong>到此Linux安全加固就结束了，限于篇幅部分内容没有详细介绍。总之，要想保证Linux系统安全，光靠这点是远远不够的，还要靠规范的制度和遵守制度的人。</strong></p>

    </div>
    <div>
  
    <div>
    
        <div style="text-align:center;color: #ccc;font-size:14px;">-------------本文结束<i class="fa fa-paw"></i>感谢您的阅读-------------</div>
    
</div>
  
</div>

    
    
    
      
       
        
<div class="my_post_copyright">
  <script src="//cdn.bootcss.com/clipboard.js/1.5.10/clipboard.min.js"></script>
  
  <!-- JS库 sweetalert 可修改路径 -->
  <script src="https://cdn.bootcss.com/jquery/2.0.0/jquery.min.js"></script>
  <script src="https://unpkg.com/sweetalert/dist/sweetalert.min.js"></script>
  <p><span>本文标题:</span><a href="/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/">Linux系统安全加固</a></p>
  <p><span>文章作者:</span><a href="/" title="访问 Odin 的个人博客">Odin</a></p>
  <p><span>发布时间:</span>2020年04月23日 - 13:04</p>
  <p><span>最后更新:</span>2020年04月23日 - 13:04</p>
  <p><span>原始链接:</span><a href="/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/" title="Linux系统安全加固">https://gwashitgton.gitee.io/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/</a>
    <span class="copy-path"  title="点击复制文章链接"><i class="fa fa-clipboard" data-clipboard-text="https://gwashitgton.gitee.io/2020/04/23/Linux%E7%B3%BB%E7%BB%9F%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/"  aria-label="复制成功！"></i></span>
  </p>
  <p><span>许可协议:</span><i class="fa fa-creative-commons"></i> <a rel="license" href="https://creativecommons.org/licenses/by-nc-nd/4.0/" target="_blank" title="Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0)">署名-非商业性使用-禁止演绎 4.0 国际</a> 转载请保留原文链接及作者。</p>  
</div>
<script> 
    var clipboard = new Clipboard('.fa-clipboard');
    $(".fa-clipboard").click(function(){
      clipboard.on('success', function(){
        swal({   
          title: "",   
          text: '复制成功',
          icon: "success", 
          showConfirmButton: true
          });
    });
    });  
</script>

      
        <div class="reward-container">
  <div>如果对您有帮助，请赞助一下吧</div>
  <button onclick="var qr = document.getElementById('qr'); qr.style.display = (qr.style.display === 'none') ? 'block' : 'none';">
    打赏
  </button>
  <div id="qr" style="display: none;">
      
      <div style="display: inline-block;">
        <img src="/images/wechatpay.png" alt="Odin 微信支付">
        <p>微信支付</p>
      </div>
      
      <div style="display: inline-block;">
        <img src="/images/alipay.png" alt="Odin 支付宝">
        <p>支付宝</p>
      </div>

  </div>
</div>

        

  <div class="followme">
    <p>欢迎关注我的其它发布渠道</p>

    <div class="social-list">

        <div class="social-item">
          <a target="_blank" class="social-link" href="/atom.xml">
            <span class="icon">
              <i class="fa fa-rss"></i>
            </span>

            <span class="label">RSS</span>
          </a>
        </div>
    </div>
  </div>


      <footer class="post-footer">
          <div class="post-tags">
              <a href="/tags/Linux/" rel="tag"><i class="fa fa-tag"></i> Linux</a>
              <a href="/tags/%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/" rel="tag"><i class="fa fa-tag"></i> 安全加固</a>
          </div>

        


        
    <div class="post-nav">
      <div class="post-nav-item">
    <a href="/2020/04/23/LinuxSSH%E5%AE%89%E5%85%A8%E5%8A%A0%E5%9B%BA/" rel="prev" title="LinuxSSH安全加固">
      <i class="fa fa-chevron-left"></i> LinuxSSH安全加固
    </a></div>
      <div class="post-nav-item">
    <a href="/2020/04/24/Windows%E6%97%A5%E5%BF%97%E7%AE%80%E8%A6%81%E8%A7%A3%E6%9E%90/" rel="next" title="Windows日志简要解析">
      Windows日志简要解析 <i class="fa fa-chevron-right"></i>
    </a></div>
    </div>
      </footer>
    
  </article>
  
  
  



          </div>
          
    <div class="comments" id="valine-comments"></div>

<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>

        </div>
          
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line toggle-line-first"></span>
    <span class="toggle-line toggle-line-middle"></span>
    <span class="toggle-line toggle-line-last"></span>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
          <div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#Linux-安全加固"><span class="nav-number">1.</span> <span class="nav-text">Linux 安全加固</span></a></li></ol></div>
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="Odin"
      src="https://gitee.com/GWashitgton/Picture/raw/master/image/20200422132544.JPG">
  <p class="site-author-name" itemprop="name">Odin</p>
  <div class="site-description" itemprop="description"></div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/archives/">
        
          <span class="site-state-item-count">20</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
            <a href="/categories/">
          
        <span class="site-state-item-count">6</span>
        <span class="site-state-item-name">分类</span></a>
      </div>
      <div class="site-state-item site-state-tags">
            <a href="/tags/">
          
        <span class="site-state-item-count">11</span>
        <span class="site-state-item-name">标签</span></a>
      </div>
  </nav>
</div>
  <div class="links-of-author motion-element">
      <span class="links-of-author-item">
        <a href="https://github.com/Grergo" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;Grergo" rel="noopener" target="_blank"><i class="fab fa-github fa-fw"></i>GitHub</a>
      </span>
      <span class="links-of-author-item">
        <a href="mailto:weikangwang730@gmail.com" title="E-Mail → mailto:weikangwang730@gmail.com" rel="noopener" target="_blank"><i class="fa fa-envelope fa-fw"></i>E-Mail</a>
      </span>
  </div>



      </div>

    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer class="footer">
      <div class="footer-inner">
        

        

<div class="copyright">
  
  &copy; 
  <span itemprop="copyrightYear">2021</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">Odin</span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item-icon">
      <i class="fa fa-chart-area"></i>
    </span>
      <span class="post-meta-item-text">站点总字数：</span>
    <span title="站点总字数">59k</span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item-icon">
      <i class="fa fa-coffee"></i>
    </span>
      <span class="post-meta-item-text">站点阅读时长 &asymp;</span>
    <span title="站点阅读时长">54 分钟</span>
</div>

        








      </div>
    </footer>
  </div>

  
  <script size="300" alpha="0.6" zIndex="-1" src="/lib/canvas-ribbon/canvas-ribbon.js"></script>
  <script src="/lib/anime.min.js"></script>
  <script src="//cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js"></script>
  <script src="//cdn.jsdelivr.net/gh/fancyapps/fancybox@3/dist/jquery.fancybox.min.js"></script>
  <script src="/lib/velocity/velocity.min.js"></script>
  <script src="/lib/velocity/velocity.ui.min.js"></script>

<script src="/js/utils.js"></script>

<script src="/js/motion.js"></script>


<script src="/js/schemes/pisces.js"></script>


<script src="/js/next-boot.js"></script>




  




  
<script src="/js/local-search.js"></script>









<script>
document.querySelectorAll('.pdfobject-container').forEach(element => {
  let url = element.dataset.target;
  let pdfOpenParams = {
    navpanes : 0,
    toolbar  : 0,
    statusbar: 0,
    pagemode : 'thumbs',
    view     : 'FitH'
  };
  let pdfOpenFragment = '#' + Object.entries(pdfOpenParams).map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join('&');
  let fullURL = `/lib/pdf/web/viewer?file=${encodeURIComponent(url)}${pdfOpenFragment}`;

  if (NexT.utils.supportsPDFs()) {
    element.innerHTML = `<embed class="pdfobject" src="${url + pdfOpenFragment}" type="application/pdf" style="height: ${element.dataset.height};">`;
  } else {
    element.innerHTML = `<iframe src="${fullURL}" style="height: ${element.dataset.height};" frameborder="0"></iframe>`;
  }
});
</script>




  

  

<script>
NexT.utils.loadComments(document.querySelector('#valine-comments'), () => {
  NexT.utils.getScript('https://cdn.jsdelivr.net/npm/valine@1.4.7/dist/Valine.min.js', () => {
    var GUEST = ['nick', 'mail', 'link'];
    var guest = 'nick,mail,link';
    guest = guest.split(',').filter(item => {
      return GUEST.includes(item);
    });
    new Valine({
      el         : '#valine-comments',
      verify     : true,
      notify     : false,
      appId      : '9avK28PbOuQyIMAUY8akDkwc-gzGzoHsz',
      appKey     : 'XKxrXsCfnD7W4M7AwOCslEvq',
      placeholder: "说点什么吧",
      avatar     : 'hide',
      meta       : guest,
      pageSize   : '10' || 10,
      visitor    : false,
      lang       : 'zh-cn' || 'zh-cn',
      path       : location.pathname,
      recordIP   : false,
      serverURLs : ''
    });
  }, window.Valine);
});
</script>

<script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"debug":false,"log":false,"model":{"jsonPath":"/live2dw/assets/z16.model.json"},"display":{"position":"left","width":200,"height":300},"mobile":{"show":false},"react":{"opacity":0.9}});</script></body>
</html>
